Results 1 to 8 of 8

Thread: Help! (Please)

  1. #1
    New Lounger
    Join Date
    Jul 2014
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Help! (Please)

    Hi,

    I am new here, and writing in a minor panic re the possible unauthorised accessing of my confidential work..I use Windows 8on HP and Toshiba laptops.

    My SD card went missing out of my wallet, turning up two hours later. The person who claimed to have found it, has,I fear, accessed it and copied documents from it. To check, I put the card in my lap top, and a number of the Word filesand one Jpeg were shown to be accessed at 00.00 on 29 July 2014 in the Properties tab.The SD card was sitting on my desk at that time, so that was impossible. However, I reset the time and date on my laptop, and it was possible to enter a file with a falsified date and time on the laptop, which, when a test file was opened, was then recorded in the file Properties. About 10 files were showing the aforementioned odd property listing, so I am very suspicious. If what I suspect, has happened, can the identity of the computer that accessed the files be traced via the forensic file data or the SD card? Does the SD and or files in question even hold that sort of forensic data? Would a specialist company be able to retrieve this?

    Any help hugely appreciated!

    Thanks,
    Lizzie

  2. Get our unique weekly Newsletter with tips and techniques, how to's and critical updates on Windows 7, Windows 8, Windows XP, Firefox, Internet Explorer, Google, etc. Join our 480,000 subscribers!

    Excel 2013: The Missing Manual

    + Get this BONUS — free!

    Get the most of Excel! Learn about new features, basics of creating a new spreadsheet and using the infamous Ribbon in the first chapter of Excel 2013: The Missing Manual - Subscribe and download Chapter 1 for free!

  3. #2
    Super Moderator CLiNT's Avatar
    Join Date
    Dec 2009
    Location
    California & Arizona
    Posts
    5,434
    Thanks
    128
    Thanked 495 Times in 455 Posts
    If what I suspect, has happened, can the identity of the computer that accessed the files be traced via the forensic file data or the SD card?
    Yes, and no.
    Most any identfying information garnered, will most likely be a meaningless hash number relavant only to the computer that the drive has been accessed by.

    I'd be more concerned that something has been changed on the card; loss of data/manipulation of same, or that some special treat has been added to the disk, like a virus, rootkit, or trogen.
    Last edited by CLiNT; 2014-07-29 at 02:37.
    DRIVE IMAGING
    Invest a little time and energy in a well thought out BACKUP regimen and you will have minimal down time, and headache.

    Windows 8.1, 64 bit
    Motherboard: DX58SO2*Chipset: X58 Express/Intel ICH10*BIOS: SOX5820J.86A.0888.2012.0129.2203*Processor: Intel Core i7 CPU X 990
    GPU: Nvidia GTX 580*Memory: Corsair 12 GB, 4x3@1600*PSU: Corsair HX1000*Hard drives: REVO X2 160GB*OCZ VERT X3 120GB*5 mechanical storage drives (12 TB) total.

  4. #3
    New Lounger
    Join Date
    Jul 2014
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Thank you so much for your reply, Clint, I really appreciate it.

    I honestly don't think the person who I suspect did this, is quite that advanced, although I could be wrong. I think I just need to prove that the SD card was accessed by a laptop other than mine...how would I get the hash number and do you know if there would there be a time stamp along with the hash number??

    Thanks,
    Lizzie
    Last edited by lizziejamescaroon; 2014-07-29 at 07:47.

  5. #4
    2 Star Lounger
    Join Date
    Jun 2011
    Location
    Hampshire (the old one)
    Posts
    142
    Thanks
    2
    Thanked 15 Times in 15 Posts
    How did the person who found it get it back to you? They may have just looked at it to see who the owner was.

  6. #5
    New Lounger
    Join Date
    Jul 2014
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    I live with them and had told them it had gone missing from my wallet (I have to carry it around as they do not respect boundaries i.e. have gone through my phone in the past etc). It went missing from my wallet (which was in my bedroom) and they claimed to have 'found' it in my room a couple of hours after I had realised it had gone missing...

  7. #6
    New Lounger
    Join Date
    Jul 2014
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Is there any way meta data of an SD card can be false??

  8. #7
    Silver Lounger
    Join Date
    Oct 2012
    Posts
    2,106
    Thanks
    12
    Thanked 241 Times in 234 Posts
    Quote Originally Posted by lizziejamescaroon View Post
    Is there any way meta data of an SD card can be false??
    Yes, but that would mean someone accessed it and knowingly falsified it. Some things could just be a result of improper settings such as date from whatever device recorded the meta data as well.

  9. #8
    New Lounger
    Join Date
    Jul 2014
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Falsifying the meta data is what I suspect. Falsified access at a time when the SD card was returned to me, but it was not in a machine at the time of stated access and had not been put in a machine since it had been 'found'. I put it in the machine at about 1.30 am this morning and the access time stamp was 00.00 29/07.14...so unless inaccurate time stamp, those files must have been accessed at a falsified time...surely?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •